The majority of attackers are unsophisticated and just deploying scripts they found or tools they bought on russian forums against whatever endpoint they can find.

The simple tools still work remarkably well.

There are very very effective services for bot detection that still rely heavily on keyboard and mouse behavior.